Splunk Search
Highlighted

How do I make a line graph with my timechart search?

Communicator

alt text

This is a table I created using the timechart command. Now, I am trying to make a line graph with this information with date on the x-axis and completion time for the y-axis. If I am able to solve that, I would love to add extra lines to the line graph.

<searchString>host=... source = ... Position="Finished" AND Report  | timechart latest(TIME) as Completion_Time</searchString>
<earliestTime>-168h</earliestTime>
<latestTime>$timetoken.latest$</latestTime>

This is inside my dashboard atm. I have a drop down for time at the top.

Tags (3)
0 Karma
Highlighted

Re: How do I make a line graph with my timechart search?

SplunkTrust
SplunkTrust

The CompletionTime field is string value and as far as I know, strings can't be plotted in Y-axis (you need numerical values). Workaround, you can convert your CompletionTime to decimal number like HH.MM and plot them.

View solution in original post

Highlighted

Re: How do I make a line graph with my timechart search?

Communicator

OH! I see.. What was the command again? str..() lol.

0 Karma
Highlighted

Re: How do I make a line graph with my timechart search?

SplunkTrust
SplunkTrust
| eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))
Highlighted

Re: How do I make a line graph with my timechart search?

Communicator

Whats the 1 and 2 for?

0 Karma
Highlighted

Re: How do I make a line graph with my timechart search?

SplunkTrust
SplunkTrust

In replace, I'm clubbing your data in 3 parts (values inside the brackets), and replacing 3 parts named 1,2,3 from current format of 1:2:3 to 1.2

Highlighted

Re: How do I make a line graph with my timechart search?

Communicator

Would you know how to add a second line?

host=.. source =.. SOMESTRINGTOLOOKFOR   | timechart latest(TIME) as Completion_Time | eval Completion_Time=tonumber(replace(Completion_Time,"(\d+):(\d+):(\d+)","\1.\2"))
0 Karma
Highlighted

Re: How do I make a line graph with my timechart search?

Communicator

Thank you somesoni2! I got the graph!

0 Karma
Highlighted

Re: How do I make a line graph with my timechart search?

Communicator

Would you know how to add a second line?

0 Karma
Highlighted

Re: How do I make a line graph with my timechart search?

SplunkTrust
SplunkTrust

What you want to show in the second line?